diff --git a/etc/modprobe.d/msr.conf b/etc/modprobe.d/msr.conf
new file mode 100644
index 0000000..c9a39bf
--- /dev/null
+++ b/etc/modprobe.d/msr.conf
@@ -0,0 +1,3 @@
+# Blacklist CPU MSRs as they can be abused to write to
+# arbitrary memory.
+install msr /bin/false